github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211: Use struct instead of macro for PREQ frame

Browse Source 
The existing PREQ_IE_* macros access HWMP PREQ frame fields via hardcoded
byte offsets. When the AE (Address Extension) flag is set, an additional
6 bytes appear mid-frame, and the macros handle this with conditional
arithmetic (e.g., AE_F_SET(x) ? x + N+6 : x + N). This approach
obscures the frame layout and is prone to miscalculation.

Introduce typed packed C structs to represent the PREQ frame layout:
  - ieee80211_mesh_hwmp_preq_top: fixed fields before the optional AE
    address
  - ieee80211_mesh_hwmp_preq_bottom: fields after the optional AE address
  - ieee80211_mesh_hwmp_preq_target: per-target fields

Add ieee80211_mesh_hwmp_preq_get_bottom() to locate the bottom struct
correctly based on whether the AE flag is set.

This preparatory refactoring is needed to fix a 2-byte overread of
target_addr in hwmp_preq_frame_process() when AE is enabled, which is
addressed in a subsequent patch.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Link: https://patch.msgid.link/20260529230952.124754-1-masashi.honma@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Masashi Honma 2026-05-30 08:09:43 +09:00 committed by Johannes Berg
parent f9ad6c1602
commit 4ac20bd40b
2 changed files with 73 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
include/linux/ieee80211-mesh.h
View File

@ -28,12 +28,40 @@ struct ieee80211s_hdr {
u8 eaddr2[ETH_ALEN];
} __packed __aligned(2);
struct ieee80211_mesh_hwmp_preq_target {
u8 flags;
u8 addr[ETH_ALEN];
__le32 sn;
} __packed;
struct ieee80211_mesh_hwmp_preq_top {
u8 flags;
u8 hopcount;
u8 ttl;
__le32 preq_id;
u8 orig_addr[ETH_ALEN];
__le32 orig_sn;
/* optional AE, lifetime, metric, target */
u8 variable[];
} __packed;
struct ieee80211_mesh_hwmp_preq_bottom {
__le32 lifetime;
__le32 metric;
u8 target_count;
struct ieee80211_mesh_hwmp_preq_target targets[];
} __packed;
/* Mesh flags */
#define MESH_FLAGS_AE_A4 0x1
#define MESH_FLAGS_AE_A5_A6 0x2
#define MESH_FLAGS_AE 0x3
#define MESH_FLAGS_PS_DEEP 0x4
/* HWMP IE processing macros */
#define AE_F (1<<6)
/**
* enum ieee80211_preq_flags - mesh PREQ element flags
*
@ -227,4 +255,18 @@ enum ieee80211_root_mode_identifier {
IEEE80211_PROACTIVE_RANN = 4,
};
static inline bool ieee80211_mesh_preq_prep_ae_enabled(const u8 *ie)
{
return ie[0] & AE_F;
}
static inline struct ieee80211_mesh_hwmp_preq_bottom *
ieee80211_mesh_hwmp_preq_get_bottom(const u8 *ie)
{
struct ieee80211_mesh_hwmp_preq_top *top = (void *)ie;
return (void *)&top->variable[
ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
}
#endif /* LINUX_IEEE80211_MESH_H */

65
net/mac80211/mesh_hwmp.c
View File

@ -35,24 +35,11 @@ static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
}
/* HWMP IE processing macros */
#define AE_F (1<<6)
#define AE_F_SET(x) (*x & AE_F)
#define PREQ_IE_FLAGS(x) (*(x))
#define PREQ_IE_HOPCOUNT(x) (*(x + 1))
#define PREQ_IE_TTL(x) (*(x + 2))
#define PREQ_IE_PREQ_ID(x) u32_field_get(x, 3, 0)
#define PREQ_IE_ORIG_ADDR(x) (x + 7)
#define PREQ_IE_ORIG_SN(x) u32_field_get(x, 13, 0)
#define PREQ_IE_LIFETIME(x) u32_field_get(x, 17, AE_F_SET(x))
#define PREQ_IE_METRIC(x) u32_field_get(x, 21, AE_F_SET(x))
#define PREQ_IE_TARGET_F(x) (*(AE_F_SET(x) ? x + 32 : x + 26))
#define PREQ_IE_TARGET_ADDR(x) (AE_F_SET(x) ? x + 33 : x + 27)
#define PREQ_IE_TARGET_SN(x) u32_field_get(x, 33, AE_F_SET(x))
#define PREP_IE_FLAGS(x) PREQ_IE_FLAGS(x)
#define PREP_IE_HOPCOUNT(x) PREQ_IE_HOPCOUNT(x)
#define PREP_IE_TTL(x) PREQ_IE_TTL(x)
#define PREP_IE_FLAGS(x) (*(x))
#define PREP_IE_HOPCOUNT(x) (*(x + 1))
#define PREP_IE_TTL(x) (*(x + 2))
#define PREP_IE_ORIG_ADDR(x) (AE_F_SET(x) ? x + 27 : x + 21)
#define PREP_IE_ORIG_SN(x) u32_field_get(x, 27, AE_F_SET(x))
#define PREP_IE_LIFETIME(x) u32_field_get(x, 13, AE_F_SET(x))
@ -415,11 +402,16 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
switch (action) {
case MPATH_PREQ:
orig_addr = PREQ_IE_ORIG_ADDR(hwmp_ie);
orig_sn = PREQ_IE_ORIG_SN(hwmp_ie);
orig_lifetime = PREQ_IE_LIFETIME(hwmp_ie);
orig_metric = PREQ_IE_METRIC(hwmp_ie);
hopcount = PREQ_IE_HOPCOUNT(hwmp_ie) + 1;
struct ieee80211_mesh_hwmp_preq_top *preq_elem_top =
(void *)hwmp_ie;
struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
ieee80211_mesh_hwmp_preq_get_bottom(hwmp_ie);
orig_addr = preq_elem_top->orig_addr;
orig_sn = le32_to_cpu(preq_elem_top->orig_sn);
orig_lifetime = le32_to_cpu(preq_elem_bottom->lifetime);
orig_metric = le32_to_cpu(preq_elem_bottom->metric);
hopcount = preq_elem_top->hopcount + 1;
break;
case MPATH_PREP:
/* Originator here refers to the MP that was the target in the
@ -579,6 +571,11 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
const u8 *preq_elem, u32 orig_metric)
{
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
struct ieee80211_mesh_hwmp_preq_top *preq_elem_top = (void *)preq_elem;
struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
ieee80211_mesh_hwmp_preq_get_bottom(preq_elem);
struct ieee80211_mesh_hwmp_preq_target *target =
preq_elem_bottom->targets;
struct mesh_path *mpath = NULL;
const u8 *target_addr, *orig_addr;
const u8 *da;
@ -589,13 +586,13 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
bool root_is_gate;
/* Update target SN, if present */
target_addr = PREQ_IE_TARGET_ADDR(preq_elem);
orig_addr = PREQ_IE_ORIG_ADDR(preq_elem);
target_sn = PREQ_IE_TARGET_SN(preq_elem);
orig_sn = PREQ_IE_ORIG_SN(preq_elem);
target_flags = PREQ_IE_TARGET_F(preq_elem);
target_addr = target[0].addr;
orig_addr = preq_elem_top->orig_addr;
target_sn = le32_to_cpu(target[0].sn);
orig_sn = le32_to_cpu(preq_elem_top->orig_sn);
target_flags = target[0].flags;
/* Proactive PREQ gate announcements */
flags = PREQ_IE_FLAGS(preq_elem);
flags = preq_elem_top->flags;
root_is_gate = !!(flags & RANN_FLAG_IS_GATE);
mhwmp_dbg(sdata, "received PREQ from %pM\n", orig_addr);
@ -655,7 +652,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
}
if (reply) {
lifetime = PREQ_IE_LIFETIME(preq_elem);
lifetime = le32_to_cpu(preq_elem_bottom->lifetime);
ttl = ifmsh->mshcfg.element_ttl;
if (ttl != 0) {
mhwmp_dbg(sdata, "replying to the PREQ\n");
@ -673,22 +670,22 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
u32 preq_id;
u8 hopcount;
ttl = PREQ_IE_TTL(preq_elem);
lifetime = PREQ_IE_LIFETIME(preq_elem);
ttl = preq_elem_top->ttl;
lifetime = le32_to_cpu(preq_elem_bottom->lifetime);
if (ttl <= 1) {
ifmsh->mshstats.dropped_frames_ttl++;
return;
}
mhwmp_dbg(sdata, "forwarding the PREQ from %pM\n", orig_addr);
--ttl;
preq_id = PREQ_IE_PREQ_ID(preq_elem);
hopcount = PREQ_IE_HOPCOUNT(preq_elem) + 1;
preq_id = le32_to_cpu(preq_elem_top->preq_id);
hopcount = preq_elem_top->hopcount + 1;
da = (mpath && mpath->is_root) ?
mpath->rann_snd_addr : broadcast_addr;
if (flags & IEEE80211_PREQ_PROACTIVE_PREP_FLAG) {
target_addr = PREQ_IE_TARGET_ADDR(preq_elem);
target_sn = PREQ_IE_TARGET_SN(preq_elem);
target_addr = target[0].addr;
target_sn = le32_to_cpu(target[0].sn);
}
mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,